Enforcement · French Data Protection Authority (CNIL) EN LLM context

SGAM AG2R LA MONDIALE: Non-compliance with general data processing principles

The French DPA (CNIL) has fined private insurer SGAM AG2R LA MONDIALE EUR 1,750,000.

€1,750,000 Fine

SGAM AG2R LA MONDIALE

FRANCE

Art. 5 GDPR Art. 13 GDPR Art. 14 GDPR

Storage Limitation Retention Period Controllers Supervisory Authorities Processing

Jul 20, 2021 Source legifrance.gouv.fr

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The French DPA (CNIL) has fined private insurer SGAM AG2R LA MONDIALE EUR 1,750,000. The CNIL had carried out an inspection at the AG2R LA MONDIALE group in 2019. On this occasion, the CNIL found that the controller kept the data of millions of individuals for an excessive period of time and did not comply with their information obligations in the context of telephone canvassing campaigns. With regard to the data of prospects, the controller did not comply with the maximum retention period of three years defined in the reference framework and in the Group's processing register. As a result, the controller retained the data of nearly 2,000 customers who had not been in contact with the controller for more than three years, and in some cases five years. In relation to customer data, the controller did not comply with the maximum statutory retention periods stipulated in the Insurance Code and the Commercial Code.

Insurance Storage Limitation Retention Period

In this case, the controller retained the data of more than 2 million customers, some of which were sensitive (health) or specific (banking data), beyond the legally permitted retention periods after the end of the contract. GDPR Articles: Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 14 GDPR Industry: Finance, Insurance and Consulting

Controllers Insurance applies Art. 5(1)Art. 13 Art. 14

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

Related across sources

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data

C-638/23 Amt der Tiroler Landesregierung v Datenschutzbehörde In Case C-638/23, the Court of Justice interpreted Article 4(7) GDPR in response to a preliminary reference from the Austrian Verwaltungsgerichtshof in proceedings between the Amt… CJEU ·Eighth Chamber Feb 27, 2025 Public Authority Controllers Personal Data

439360 French Conseil d'État strikes down GendNotes police app decree for excessive special data In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile… CE Apr 13, 2021 Types of Special Categories of Personal Data Retention Period Personal Data

C-768/21 TR v Land Hessen In Case C-768/21, the Court of Justice of the European Union (First Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning TR's challenge of… CJEU ·First Chamber Sep 26, 2024 Supervision Data Breaches Integrity and Confidentiality Principle